FINTRAC's enforcement surge: what two years of penalties tell us

Since 2024, FINTRAC's enforcement surge has been substantial in both the number of administrative monetary penalties issued and the average dollar value attached to each. The regulator moved from a posture of guidance and remediation to visible, public enforcement, and the climb cannot be dismissed as an isolated cycle. Three shifts drove it in parallel: examination capacity expanded, so more entities face on-site or virtual examinations on shorter cycles; tolerance for recurring deficiencies narrowed; and the public naming convention was used more aggressively, turning a private compliance matter into a reputational event. The pattern reflects an explicit priority to move the regime toward outcomes-based, dissuasive enforcement. For Canadian non-bank reporting entities, this is the single most important compliance trend to absorb, because the curve is unlikely to flatten and every unaddressed gap now carries a larger and more public downside.

Money services businesses, including foreign MSBs operating into Canada, payment service providers entering the formal regulatory perimeter, and crypto-asset service providers with high transaction velocity have driven the bulk of the AMP increase. The common thread is exposure without a buffer. Larger banks absorb examination findings inside dedicated remediation programs, but these leaner sectors typically do not have that cushion. A single examination cycle can surface dozens of findings, and the cost of remediation, consultants, software, and hiring, frequently exceeds the penalty itself. That compounding effect is what makes the trend particularly painful for sub-100-person firms. The four violation categories behind most recent penalties are foundational rather than exotic: missing or late suspicious transaction reports, deficient compliance program documentation, inadequate ongoing monitoring, and recordkeeping failures. Any firm concentrated in these sectors should assume it is on a shorter examination cycle and price the downside accordingly.

Examiners keep finding the same foundational deficiencies, and four categories drive the majority of recent penalties. First, suspicious transaction reports that are missing, late, or filed without sufficient narrative or supporting evidence. Second, deficient compliance program documentation: risk assessments that are generic, policies that do not match actual operations, and training records that cannot be produced. Third, inadequate ongoing monitoring, where relationships rated low risk should have been escalated, or risk ratings were never refreshed after material changes. Fourth, recordkeeping failures such as missing beneficial ownership information, incomplete know-your-client records, or transaction records that cannot be reconstructed for an examiner. None of these are exotic; they are the basic pillars every program is supposed to cover. That is why they recur, and why an audit trail that reconstructs decisions by default, with timestamps and evidence attached, is the trait firms that pass examinations tend to share.

Yes, and small firms are the least protected from the trend, not the most. The per-occurrence model means a single foundational deficiency aggregates fast across a customer book or a reporting period, so a lean firm can face a total that looks nothing like a single fine. Larger banks absorb examination findings inside dedicated remediation programs; money services businesses, payment service providers, crypto firms, and credit unions typically have no such buffer. A single examination cycle can surface dozens of findings, and the cost of remediation, consultants, software, and hiring, frequently exceeds the penalty itself. The surge is calibrated to make the cost of non-compliance exceed the cost of fixing the program, which is the behavioural change it is designed to drive. The firms that treat compliance as an operating system rather than a binder are the ones avoiding the headlines; every other firm is one examination away from finding its gaps.